Medical Dictation Without the Cloud: A Privacy-First Approach for HIPAA

You are between patients, dictating a post-visit note: a patient name, a date of birth, a diagnosis, and a treatment plan. If your dictation app sends that audio to a cloud service, the recording has just left your device and reached a third party. It contains protected health information, and whether that disclosure is permitted depends on paperwork most clinicians never see.

Cloud dictation sends patient audio to remote servers for processing. On-device transcription runs speech recognition on your Mac, so the transcription step does not need to send audio anywhere. That distinction does not make a workflow compliant on its own, but it removes one party from the chain and simplifies what your compliance team has to review.

This article explains what HIPAA says about dictation audio, what changes when transcription happens locally, and how to set up a local dictation workflow your organization can review.

Dictated Patient Details Are Health Information

Most clinicians think of protected health information as what lives in the EHR: typed notes, lab results, billing codes. The HIPAA definitions are broader. "Health information" covers information "whether oral or recorded in any form or medium,"^[1] and protected health information includes individually identifiable health information "transmitted or maintained in any other form or medium."^[1]

That means a recording of you saying a patient's name alongside a clinical observation is health information in recorded form. Your dictation app is not just a productivity tool. It is a system that creates, and may transmit or store, that information.

A vendor that "creates, receives, maintains, or transmits protected health information" on behalf of a covered entity is a business associate.^[1] A cloud dictation service that receives patient audio fits that description.

What HIPAA Requires When a Vendor Handles Dictation Audio

When a vendor is a business associate, three obligations follow.

A written agreement. A covered entity may let a business associate handle protected health information only if it "obtains satisfactory assurance that the business associate will appropriately safeguard the information," and those assurances "must be documented through a written contract or other written agreement or arrangement."^[2] In practice, this is the business associate agreement (BAA).

Safeguards. The HIPAA Security Rule sets out administrative, physical, and technical safeguards for electronic protected health information,^[6] and the BAA extends those expectations to the vendor.

Breach notification. If unsecured protected health information is breached, the covered entity must notify each affected individual "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach."^[3]

Before you dictate patient details into any cloud tool, confirm that your organization has a BAA with that vendor. Many consumer apps do not offer one, and some state in their terms that they are not intended for health information.

With on-device transcription, no vendor receives the audio for the transcription step. Your compliance team still needs to review the device, where transcripts are stored, and any app the text moves into.

How Cloud Dictation Handles Your Audio

Here is what typically happens when you dictate into a cloud service. Your microphone captures audio. The app compresses it, opens an encrypted connection to the vendor, and sends the audio. The vendor's servers transcribe it and return text. What happens to the recording afterwards depends on the vendor's retention policy and your agreement.

There are three places to look:

• In transit. Encryption protects the audio on the way, which is necessary but only covers the trip.
• At rest. The vendor may store audio for some period, on infrastructure it or its own providers run.
• Access. Depending on the vendor's terms, staff or automated systems may access audio for quality assurance or model improvement.

None of this is automatically improper. A vendor with a BAA, clear retention terms, and documented safeguards may be an appropriate choice. The point is that each of those items has to be checked, documented, and revisited.

The On-Device Alternative: Removing a Party From the Chain

On-device transcription works differently. A Whisper-based app loads a speech model on your Mac and transcribes there:

1. 1.Microphone capture: audio enters your Mac's audio system.
2. 2.Local processing: the audio is passed to a speech model running on your Mac.
3. 3.Model inference: the model produces text.
4. 4.Text output: the transcript appears in your application.

No speech vendor receives the audio for that step. You can check the behavior yourself: watch Activity Monitor's Network tab while you dictate with the network connected, and block the app's network access with an outbound firewall to confirm transcription still works offline. Offline success alone shows the app can transcribe locally, not that it never uses the network when connected. Our guide to auditing a transcription app walks through the steps.

Local transcription is not the whole workflow. The transcript still lives somewhere: in a draft, on the clipboard, in the EHR. Your organization's device security, backups, access controls, and retention rules still apply.

Medical Terminology Accuracy: How to Evaluate Local Models

A common objection from clinicians who use purpose-built medical dictation products is that general speech models will not know clinical vocabulary. It is a fair concern, and the honest answer is that accuracy depends on the model size, your speech, your specialty, and your microphone. The way to settle it is a test, not a claim.

Whisper was trained on 680,000 hours of labeled audio,^[4] which covers a wide range of speech, but it was not built specifically for clinical dictation. Run your own comparison:

1. 1.Write a de-identified note of about 200 words using the terms you dictate most: drug names, dosages, anatomy, and abbreviations.
2. 2.Dictate it into each tool you are considering, using the same microphone.
3. 3.Count errors, and mark critical ones separately: a wrong drug, dose, laterality, or negation.

Three speaking habits help any model with clinical terms:

• Pause around abbreviations. Say "metformin, pause, twice daily" or spell the abbreviation rather than running it into the drug name.
• Speak drug names at a steady pace. Rushing multi-syllable names invites dropped syllables.
• Spell rare terms. For uncommon drug names or gene variants, spelling them out is often more reliable. A custom vocabulary list helps with recurring terms.

Always review the transcript before it enters the record. Speech recognition is a drafting aid, and the clinician remains responsible for the note.

A Practical Local Dictation Workflow for Clinicians

Setup

1. 1.Check your Mac. Auditory supports Apple silicon and Intel Macs running macOS 14 or later. Larger models need more memory.
2. 2.Install a local dictation app that runs speech recognition on the Mac. Auditory transcribes with local Whisper models and, after you install the models you want, can work without an active internet connection.
3. 3.Download the model you will use and test it before clinical use.
4. 4.Choose a microphone. A headset or directional microphone close to your mouth reduces room noise in busy clinical spaces.

Dictation

Dictate after the encounter at a steady pace. Review the cleaned-up text, paying particular attention to names, numbers, drug names, and negations. For more on how cleanup works, see our article on how AI text cleanup works.

Moving text into the EHR

Paste the reviewed text into your EHR. A clipboard-based workflow avoids sending the text through an extra integration, but confirm with your IT team how clipboard managers, sync tools, and backups on the device are configured.

Organizational review

Ask your compliance or IT team to document the workflow: the device, the app, where drafts are stored, how long they are kept, and who can access them. A local speech step simplifies that review but does not replace it.

Cost Considerations

Compare options on more than the subscription price. For a cloud dictation service, include licensing, the time to review and maintain a BAA, and periodic vendor reassessment. For a local tool, include the software price, the Mac you will run it on, and the time to configure device security and downstream controls. Auditory's current plans are listed on the pricing page.

The right answer depends on your organization's size, specialty, and existing systems. Run the comparison with your own numbers.

Your Next 30 Minutes: Setting Up Private Medical Dictation

1. 1.Check your Mac: Apple menu, About This Mac. Note the chip and memory.
2. 2.Install a local dictation tool and download the model you plan to use.
3. 3.Run a test dictation with a fictional patient: "Patient John Doe, date of birth January 1, 1955, presents with atrial fibrillation, currently on apixaban 5mg b.i.d." Check every word.
4. 4.Check network behavior: watch the app's sent data while dictating online, then block its network access and confirm transcription still works.
5. 5.Bring your compliance team in before using the workflow with real patient information.

One metric to track this week: the number of times your current dictation workflow sends audio off your device. If you use a cloud service, confirm that a BAA covers it.

Frequently Asked Questions

Does local dictation work completely offline?

For the transcription step, yes, once the models you want are installed. Auditory can transcribe and clean up speech without an active internet connection after setup.

Does local transcription make my workflow HIPAA compliant?

No tool is compliant on its own. HIPAA compliance depends on your organization's policies, safeguards, and agreements. Local transcription means no speech vendor receives the audio for that step, which removes one business associate relationship from the review, but device security, storage, access, and retention still need to be in place.

What about ambient documentation tools that listen during the visit?

Ambient tools record the patient conversation and typically process it with a vendor. Local dictation is clinician-initiated: you dictate after the encounter. These are different workflows. If you evaluate ambient tools, review their BAAs and data handling carefully.

Is Whisper "HIPAA certified"?

There is no government HIPAA certification for software. HIPAA obligations attach to covered entities and their business associates. A speech model running locally on your own device is not a business associate, but the rest of your workflow still needs review.

References

[1] 45 CFR 160.103, Definitions (Cornell Legal Information Institute). https://www.law.cornell.edu/cfr/text/45/160.103

[2] 45 CFR 164.502, Uses and disclosures of protected health information (Cornell Legal Information Institute). https://www.law.cornell.edu/cfr/text/45/164.502

[3] 45 CFR 164.404, Notification to individuals (Cornell Legal Information Institute). https://www.law.cornell.edu/cfr/text/45/164.404

[4] Radford et al., Robust Speech Recognition via Large-Scale Weak Supervision (2022). https://arxiv.org/abs/2212.04356

[5] OpenAI, Whisper repository README. https://github.com/openai/whisper

[6] 45 CFR Part 164, Subpart C, Security Standards for the Protection of Electronic Protected Health Information (Cornell Legal Information Institute). https://www.law.cornell.edu/cfr/text/45/part-164/subpart-C